fix(jangar): fetch main before rollout ancestry check

[gregkonush]

Summary

• Fetch origin/main before declaring an Argo-synced revision unavailable during rollout ancestry checks.
• Add regression coverage for the race where Argo syncs a newer main commit that is not present in the verifier checkout.
• Use ancestor revision matching for manual jangar-post-deploy-verify reruns with an explicit expected revision.

Related Issues

None. Follow-up to the #5563 post-deploy verification false negative.

Testing

• PASS: bun install --frozen-lockfile --ignore-scripts
• PASS: bunx oxfmt --check packages/scripts/src/jangar/verify-deployment.ts packages/scripts/src/jangar/__tests__/verify-deployment.test.ts
• PASS: bun test packages/scripts/src/jangar/__tests__/verify-deployment.test.ts
• PASS: bun run --cwd packages/scripts lint (0 errors; existing unrelated warnings remain)
• PASS: bun run --cwd packages/scripts lint:oxlint:type (0 errors; existing unrelated warnings remain)
• PASS: go run github.com/rhysd/actionlint/cmd/actionlint@latest -color -ignore 'label "arc-arm64" is unknown' .github/workflows/jangar-build-push.yaml .github/workflows/jangar-release.yml .github/workflows/jangar-deploy-automerge.yml .github/workflows/jangar-post-deploy-verify.yml .github/workflows/jangar-guardrails.yml

Screenshots (if applicable)

N/A

Breaking Changes

None.

Checklist

• Testing section documents the exact validation performed (or N/A with justification).
• Screenshots and Breaking Changes sections are handled appropriately (removed or filled in).
• Documentation, release notes, and follow-ups are updated or tracked.

[gregkonush]

Merge gate: passed for #5568 and follow-on Jangar promotion #5572.

Evidence:

• fix(jangar): fetch main before rollout ancestry check #5568 squash-merged at 01717359958061b115051d7d36a54ed3bc3f4551 after the current check set was green, including agents integration, packages-scripts, jangar-ci, and Jangar workflow guardrails.
• Main push CI for fix(jangar): fetch main before rollout ancestry check #5568 is green: packages-scripts, agents-ci, Jangar guardrails, Jangar build-push, and Docker Build and Push all passed.
• chore(jangar): promote image 01717359 #5572 promoted the image built from fix(jangar): fetch main before rollout ancestry check #5568. Post-deploy run 25404149517 passed with Argo Synced and Healthy at 30a5b4d1118b497ab8e483aa579dac391efe3303.
• Current live Jangar image is 01717359@sha256:a74d815597125bd164f7d4862af98e0f8bf1e50df765ace94d47b66566fb0f85.
• Cluster probes show Jangar, agents, and agents-controllers pods ready with zero restarts; /health and /ready return HTTP 200.

Residual risk:

• /ready still reports execution_trust degraded because jangar-control-plane:verify is stale and torghut-quant:discover has consecutive failures. Serving rollout is healthy, but swarm admissions remain held until those evidence windows are refreshed.